text-line-parser@1.0.0

Analysis

text-line-parser@1.0.0 runs a postinstall script (postinstall.js) on installation that performs host reconnaissance and exfiltration. The script collects: hostname, username, current directory, OS details, container/docker environment detection, process tree, GitHub CI environment variables (GITHUB_REPOSITORY, GITHUB_ACTOR, GITHUB_RUN_ID, CI, RUNNER_NAME), network configuration (IP addresses, DNS servers), cloud metadata endpoint probes (Tencent Cloud and AWS), and the full environment variable block. All collected data is base64-encoded and exfiltrated via HTTP GET to pzs5w7ntzhsnepwk564lyfdci3oucl0a[.]oastify[.]com/z?d=<base64 data>. The environment dump captures any secrets, tokens, and API keys present in the CI/CD runner environment.